People don’t have weak passwords because they’re careless. They have weak passwords because, for twenty years, the official advice was actively counterproductive — and a lot of it is still being enforced. Picture the classic corporate policy: an uppercase letter, a number, a symbol, and a forced change every ninety days. What it reliably produces is Spring2026!, then Summer2026!, then Autumn2026! — technically compliant, trivially guessable. That’s the problem we’re actually solving here, and the fix is simpler than the rules that caused it.
Why the old rules backfired
The “complexity” doctrine assumed the enemy was a human guessing at a keyboard. Against software that tests billions of candidates a second, it falls apart, because the substitutions people make are utterly predictable. Swapping a for @ or o for 0 doesn’t slow a cracking tool down by a measurable amount — those rules are the first thing it tries. (I walk through exactly how fast that goes in how long it takes to crack a password.)
Worse, complexity rules push people toward short passwords, because long and complex and memorable is too much to ask of a human brain managing 100-plus accounts. So they reuse, they pattern, they write things down. The rule meant to help becomes the reason the password is weak.
The one rule that actually matters: length beats complexity
Here’s the whole of modern password science in a sentence: every character you add multiplies the attacker’s work exponentially, while complexity only adds a little. A 16-character all-lowercase password is dramatically harder to brute-force than an 8-character one bristling with symbols. This is now the mainstream position — NIST’s own guidance favours length and explicitly discourages forced complexity and arbitrary expiry. If your IT department still mandates a 90-day reset, they’re a revision behind.
So the goal isn’t “complex.” The goal is long and unpredictable. That reframing is what makes the rest easy.
The passphrase: long and memorable, finally compatible
If humans are bad at remembering random character soup, how do we get length? We stop using characters as the unit and start using words. A passphrase is four or more randomly chosen, unrelated words strung together. The randomness is the whole point — correct horse battery staple works; a famous quote or song lyric does not, because those are in the dictionaries too.
A quick ladder of better to best:
- Weak:
xT7$pL9@— short, painful to remember, and not actually that strong. - Better:
PurpleMonkeyDishwasher— long and memorable, but the words have cultural links a smart attack can exploit. - Best:
velvet-coffee-sunrise-mountain— genuinely unrelated words, separated by a character, long enough that brute force is hopeless.
The reason this is my go-to recommendation for non-technical people is that it doesn’t feel like a security chore. It feels like remembering a silly little phrase, which humans are great at. (Never reuse the examples above, of course — generate your own.)
The method I actually teach
When I set someone up, this is the exact sequence:
- One memorable master passphrase. Four or five unrelated random words, 16+ characters. This is the only password you ever memorise. Make it with our passphrase generator so it’s truly random, not something your brain “chose” (your brain is biased and predictable).
- A password manager for everything else. Your master passphrase unlocks it; the manager generates and stores long random strings for every site. You stop knowing your own passwords, which is exactly the point — you can’t leak or reuse what you don’t know. Here’s which managers I recommend.
- A satisfying compromise for dumb policies. When a site insists on an uppercase and a symbol, don’t fight it — capitalise a letter in the middle and separate your words with a symbol:
copper7-telescope-velvet9-canyon. You keep the length; you tick their box. - Unique, everywhere, no exceptions. The strongest password on earth is worthless if you reuse it on a forum that gets breached. The manager makes “unique everywhere” effortless, which is the only reason people actually do it.
What “strong” looks like, side by side
| Approach | Example | Verdict |
|---|---|---|
| Substitution | P@ssw0rd2026! | Fails — every swap is checked first |
| Keyboard walk | qweasdzxc123 | Fails — physical patterns are mapped |
| Passphrase | copper-telescope-velvet-canyon | Holds — length makes brute force hopeless |
The honest bottom line
Stop trying to be clever. Cleverness is exactly what the cracking tools are tuned to defeat. Memorise one strong passphrase, let software handle the rest, and make everything long rather than complicated. That’s it — that’s the whole method, and it’s the same one I’d set up for my own family.
Want to feel the difference before you commit? Type a candidate into the PassGuard Check strength tester and watch the estimated crack time move as you make it longer. It all runs locally in your browser — nothing you type is ever stored or sent anywhere.